diff options
Diffstat (limited to 'chapter08/gcc.xml')
| -rw-r--r-- | chapter08/gcc.xml | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/chapter08/gcc.xml b/chapter08/gcc.xml index 171808df2..fe8e767d1 100644 --- a/chapter08/gcc.xml +++ b/chapter08/gcc.xml @@ -108,18 +108,21 @@ cd build</userinput></screen> <note id="pie-ssp-info" xreflabel="note on PIE and SSP"> <para> - PIE (position independent executable) is a technique to produce - binary programs that can be loaded anywhere in memory. Together - with a feature named ASLR (Address Space Layout Randomization), - this allows programs to never have the same memory layout, - thus defeating attacks based on reproducible memory patterns. + PIE (position-independent executable) is a technique to produce + binary programs that can be loaded anywhere in memory. Without PIE, + the security feature named ASLR (Address Space Layout Randomization) + can be applied for the shared libraries, but not the exectutable + itself. Enabling PIE allows ASLR for the executables in addition to + the shared libraries, and mitigates some attacks based on fixed + addresses of sensitive code or data in the executables. </para> <para> SSP (Stack Smashing Protection) is a technique to ensure that the parameter stack is not corrupted. Stack corruption can for example alter the return address of a subroutine, - which would allow transferring control to an attacker program instead - of the original one. + which would allow transferring control to some dangerous code + (existing in the program or shared libraries, or injected by the + attacker somehow) instead of the original one. </para> </note> |